Fix: prevent signed integer overflow in OP_MSG message sizes (#2693)

HyperPS · Jibola · web-flow · commit 44a5734ffb61 · 2026-05-21T16:42:05.000-04:00
Co-authored-by: Jib &lt;Jibzade@gmail.com&gt;
Co-authored-by: Jib &lt;jib.adegunloye@mongodb.com&gt;
diff --git a/pymongo/_cmessagemodule.c b/pymongo/_cmessagemodule.c
@@ -60,7 +60,7 @@ static PyObject* _error(char* name) {
  * Returns 0 on failure */
 static int buffer_write_bytes_ssize_t(buffer_t buffer, const char* data, Py_ssize_t size) {
     int downsize = _downcast_and_check(size, 0);
-    if (size == -1) {
+    if (downsize == -1) {
         return 0;
     }
     return buffer_write_bytes(buffer, data, downsize);

Original file line number	Diff line number	Diff line change
`@@ -60,7 +60,7 @@ static PyObject* _error(char* name) {`
`60`	`60`	`* Returns 0 on failure */`
`61`	`61`	`static int buffer_write_bytes_ssize_t(buffer_t buffer, const char* data, Py_ssize_t size) {`
`62`	`62`	`int downsize = _downcast_and_check(size, 0);`
`63`		`- if (size == -1) {`
	`63`	`+ if (downsize == -1) {`
`64`	`64`	`return 0;`
`65`	`65`	`}`
`66`	`66`	`return buffer_write_bytes(buffer, data, downsize);`